When $wgAllowCopyUploads is false, there is no need for the corrosponding user right upload_by_url to be activ for sysop by default.
Maybe remove that user right per comment out or per condition on
$wgAllowCopyUploads.
Thanks.
Version: 1.18.x
Severity: enhancement